Summary
A recording of a consultation is health data, which UK GDPR treats as special category data and holds to a higher bar than an email address. That single fact drives every question worth asking a scribe vendor.
Six questions settle it. Your lawful basis, whether a data protection impact assessment is needed, the processor agreement, where the data lives, how long it is kept, and whether it trains a model.
None of this is exotic and all of it is answerable in plain sentences. A vendor that reaches for vague reassurance on any of the six is telling you something.
See it in your clinicAsk us the six questions on a call and hear plain answers.
Request a demoYour lawful basis
Processing health data needs a condition under Article 9 as well as a lawful basis under Article 6. For a clinician documenting care, the provision of healthcare condition usually applies, sitting alongside your duty of confidentiality.
The point is to have named it. A clinic that can state its Article 6 and Article 9 basis for using a scribe has done the thinking. One that cannot has not started.
A data protection impact assessment
Using new technology to process special category data at scale is close to the textbook trigger for a DPIA, and the ICO expects one where processing is likely to be high risk. For most clinics adopting an ambient scribe, completing a DPIA is the safe and correct step.
A good vendor helps you complete it and shares the information you need. A vendor that has never heard the term is a warning in itself.
The processor agreement, residency and retention
The vendor is your data processor, so you need an Article 28 processor agreement setting out what they may do with the data. Then three plain facts. Where the audio and transcript are processed, ideally the UK or EU. How long they are kept, which should be a defined limit, not forever. And who can access them, which should be role-based.
Write the answers down. They belong in your record of processing and in the DPIA.
Training on your patients' data
This is the question patients would ask if they knew to. The safe answer is that identifiable consultation data is not used to train models without an explicit, separate and lawful basis, and ideally not at all.
Get it in writing. A default that quietly feeds your consultations into model training is a default you want turned off before the first recording. That question and the three others worth getting in writing are in what to ask a scribe vendor.
How wai answers the six
wai acts as the clinic's processor under a written data-processing agreement. Processing and retention are set for UK and EU handling, access is role-based, and identifiable data is not used to train models.
We will walk your DPO or practice manager through all six on a call, in plain sentences, which is the standard every vendor should be held to.
Bring your own clinic to it. Thirty minutes, and you see it on your workflows.
Request a demoFrequently asked questions
Is a consultation recording personal data under UK GDPR?
A consultation recording is personal data under UK GDPR, and more than that. A recording of a consultation is health data, which UK GDPR classifies as special category data and protects more strictly than ordinary personal data. That is why using an ambient scribe needs a lawful basis under Article 6, a condition under Article 9, and usually a data protection impact assessment before you start.
Do I need a DPIA to use an AI scribe?
In most cases yes. Using new technology to process special category health data at scale is close to the ICO's textbook trigger for a data protection impact assessment. Completing a DPIA before adopting an ambient scribe is the safe and correct step, and a good vendor will give you the information you need to finish it rather than leaving you to guess.
Will an AI scribe use my patients' data to train its models?
Whether an AI scribe uses your patients' data to train its models depends entirely on the vendor, which is why you ask before you buy and get the answer in writing. The safe position is that identifiable consultation data is not used to train models without an explicit and separate lawful basis, and ideally not at all. wai does not train models on identifiable patient data, and states its UK and EU processing and retention plainly.
What lawful basis covers an AI scribe under UK GDPR?
Processing health data needs a condition under Article 9 as well as a lawful basis under Article 6. For a clinician documenting care, the provision of healthcare condition usually applies, sitting alongside your duty of confidentiality.
What should the processor agreement with a scribe vendor cover?
The vendor is your data processor, so you need an Article 28 processor agreement setting out what they may do with the data. Then three plain facts. Where the audio and transcript are processed, ideally the UK or EU. How long they are kept, which should be a defined limit, not forever. And who can access them, which should be role-based.
Sources
Six questions, plain answers.
Thirty minutes with your DPO or practice manager and we will answer all six UK GDPR questions in the open.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
See what wai does between the visits